The court upheld Microsoft's complaint about harm to its brands and allowed it to seize control of Trickbot's servers.
Microsoft has carried out a legal coordinated attack on the Trickbot botnet, a malware-as-a-service (MaaS) cyber threat that has infected millions of computers worldwide and is used to distribute ransomware. However, the botnet was not completely destroyed.
A Virginia state court allowed Microsoft to take control of the many servers that Trickbot uses to communicate with infected systems. It is noteworthy that the basis for the court decision was the fact that the botnet operators violated Microsoft's copyright.
“We destroyed the Trickbot botnet thanks to the court order we received and technical actions we took with telecommunications providers around the world. We have disabled key infrastructure so that Trickbot operators will no longer be able to infect new systems or activate already installed ransomware, ” said Tom Burt , corporate vice president of security and customer trust for Microsoft.
According to Microsoft's legal filings, Trickbot is causing irreparable damage to its reputation, brands and customers. “Defendants physically modify and damage Microsoft products, in particular Microsoft Windows. After Trickbot infected the system, made changes to it and took control, the Windows operating system ceases to function normally and becomes a tool for theft for the Defendants, ”the documents say.
According to a civil lawsuit filed by Microsoft on October 6 this year in the District Court for the Eastern District of Virginia, attackers are harming its Microsoft and Windows trademarks by misleading users.
“Users affected by these malicious applications mistakenly believe that Microsoft and Windows are the source of the problem. There is a great risk that users might attribute this problem to Microsoft and associate it with Microsoft Windows products, which weakens and shames the Microsoft and Windows trademarks and brands, ”the documents said.
Microsoft said it intends to use the hijacked Trickbot servers to identify and assist Windows users affected by the Trickbot malware.